Chris Leonti

REOPENED TOPIC: Have Agent And Console Show Same Scan Time

The original topic had been accidentally closed and I was requested to create a new one if this is still a need. I will copy the original request below and then add my new comment in a separate post.

Hello,

When reviewing the scan history agents show the start time and the console shows the scan end time. This can lead to some pretty interesting discrepancies, especially when there are long scans. This is even more confusing as the console's field is labeled SCAN DATE when in reality it is the scan ending date/time. While it can be handy to know the end time, the starting date/time is typically more valuable.

In this example, the circled items are the same scan with the console showing a SCAN DATE of 4/21/2016 and the agent showing a START DATE of 4/15/2016. While most folks will eventually be able to connect the scans, it is much harder than it should be.

I feel it is much better for both the console and the agent to report the same information - the actual starting date and time of the scan.

Thanks for considering this change.

Chris

C

Chris Leonti

said
over 2 years ago

Hello,

We regularly see scans that run in double digit hours and sometimes over 24 hours even with RapidScan enabled. This is due to the fact that USB drives do not use RapidScan (see request regarding this) combined with having a number of users with large amounts of data. This is compounded by having scans that are over 24 hours not accurately report their duration (see request regarding this). The difficulty of matching up scans between the agent and server is unnecessarily complex and we would expect an enterprise product to have both sides report the same information with the same nomenclature, but that is not currently the case.

As an example, look at this image showing the server and agent side of one system:

While we can eventually figure match the scans, it is not immediately apparent. This is compounded by the USB insertion scans showing as Right-Click on the agent/Custom Scan on the server and deep scans show as Full on the agent/Deep Scan on the server. Regardless of scan length, it is just plain frustrating to have to play detective to match a scan on the agent and server instead of everything being reported the same way. It does not breed end-user or management confidence to be on the phone and need to say things like "look for a scan on the 20th...no not that one...no not that one...yeah that's the one." While we try to do as much work as possible without relying on the user, it cannot be completely avoided - especially with someone off-site - and then we have to try to figure things out over the phone while trying to remember what the agent side of the puzzle looks like. Having numerous elements with different dates/times/descriptions/etc. between the two sides makes it much harder than it should be to determine what you are looking for. We should be able to say "look for the USB insertion scan at 9:15am on the 20th" but cannot.

I hope this clears the situation up.

David Corlette

said
about 2 years ago

I'm checking with Engineering on this one. I think they've done some work on the >24h scan time problem, FWIW.